REMARKS 

This is a full and timely response to the outstanding Office Action mailed August 12, 
2008. Upon entry of this response, claims 1 - 46 remain pending. Reconsideration and 
allowance of the application and presently pending claims are respectfully requested. 

I. Rejections Under 35 U.S.C. S101 

The Office Action indicates that claims 14-18 stand rejected under 35 U.S.C. §101 as 
allegedly being directed to non-statutory subject matter. The Office Action argues that 
"recitation of 'means for' does not necessarily result in a 'statutorily recognized claim." The 
Office Action continues, arguing that "[Ajpplicant has shown within the [Ajpplicant's specification 
that the recited means of claims 14-18 are implemented as software. Applicants disagree. 
More specifically, as illustrated, among other places, on page 3, the present application 
discloses a "client 12 [that] comprises a processor or central processing unit (CPU) 20; a 
memory 22 having an operating system 24..." (paragraph [0010]). Further, also on page 8, the 
present application discloses that the "[sjecurity module 70 may comprise software, hardware, 
or a combination of software and hardware" (paragraph [0012]). As illustrated in these 
passages, at least one embodiment for a means component of claims 14-18 may include a 
specific hardware component that is configured to implement the claimed function. Similarly, 
other embodiments may include a processor and/or a memory (and/or other components) that 
facilitate the claimed function. The Office Action neglects the disclosure of the corresponding 
structure in order to impermissibly limit the scope of claims 14 - 18 to only software, contrary to 
35 U.S.C. §112116 and MPEP §2181. Applicants explicitly utilize the "means for" language to 
invoke 35 U.S.C. §1 121|6, to thereby preclude nonstructural elements disclosed in the 
specification. Accordingly, Applicants traverse this rejection and submits that claim 14-18 
meet all the requirements of 35 U.S.C. §101. 
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II. 



Rejections Under 35 U.S.C. g102 



A. Claim 1 is Allowable Over Thompson 

The Office Action indicates tliat claim 1 stands rejected under 35 U.S.C. §1 02(b) as 

allegedly being anticipated by European Patent Number 1,111,495 {"Thompson"). Applicants 

respectfully traverse this rejection on the grounds that Thompson does not disclose, teach, or 

suggest all of the claimed elements. More specifically, claim 1 recites: 

A computer security system, comprising: 
a processor; and 

a memory component that stores: 

a security module adapted to control access to a 
secure computer resource by a user via a client based on 
verification of a security credential provided by the user; and 

verification data disposed on the client and 
accessible by the security module, the security module adapted to 
enable the user to recover the security credential from the 
client based on a response received from the user associated 
with the verification data. 
(Emphasis added). 

Applicants respectfully submit that claim 1 is allowable over the cited art for at least the 

reason that Thompson fails to disclose, teach, or suggest a "computer security system, 

comprising... a memory component that stores... verification data disposed on the client and 

accessible by the security module, the security module adapted to enable the user to recover 

the security credential from the client based on a response received from the user 

associated with the verification data" as recited in claim 1 . More specifically, the Office 

Action argues that Thompson, with regard to FIG. 4: 

herein disclosed is information disposed on the client 
which implements a recovery mechanism... for the purpose of 
examination, the examiner interprets "to recover the security 
credential from the client" in a manner consistent with the 
applicant's specification. Specifically, the applicant states in 
paragraph 15, "For example, as used herein, "recovering" security 
credential 100 includes enabling the user to independently reset 
security credential 100, and/or automatically having security 
credential 100 reset for the user by security module 70 without 
assistance from support personnel or an external computer 
resource. 
(OA page 3, line 13). 
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Applicants commend the Examiner for referring to the specification to determine the 
proper scope of claim elements, but respectfully disagrees with this analysis for at least the 
reason that the Office Action appears to analyze the passage cited from the specification in a 
vacuum. More specifically, beginning on the first line paragraph [0015], the present application 
states "[v]erification data 94 comprises information associated with a auerv/response 
mechanism to enable the user of client 12 to independently recover a security credential 10 
independent of a computer resource external to client 12" ( emphasis added ). As illustrated in 
this passage, the term "recover" does not appear to be limited to merely resetting a security 
credential. The term "recover" instead is to be viewed as an action that is utilized when the 
security credential is lost and/or is otherwise unavailable to a user. 

Conversely, Thompson discloses receiving a password from a user (FIG. 4, block 404), 
determining whether the received password is valid (FIG. 4, block 408), and changing the 
password (FIG. 4, blocks 412, 414, 420). As illustrated in FIG. 4, the password of Thompson is 
known, and the user is merely changing the known password to a new known password. 
Consequently, nothing in Thompson is "recovered" and thus, the Office Action has failed to 
establish a proper 34 U.S.C. §1 02(b) rejection. For at least these reasons. Applicants 
respectfully traverse this rejection, and submits that claim 1 is allowable in view of the cited art. 

B. Claim 14 is Allowable Over Thompson 

The Office Action indicates that claim 14 stands rejected under 35 U.S.C. §1 02(b) as 

allegedly being anticipated by European Patent Number 1,111,495 (^'Thompson"). Applicants 

respectfully traverse this rejection on the grounds that Thompson does not disclose, teach, or 

suggest all of the claimed elements. More specifically, claim 14 recites: 

A computer security system, comprising: 

means for controlling access to a secure computer 

resource associated with a client based on verification of a 

security credential provided by a user of the client; and 
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means for accessing verification data disposed on the 
client to enable the user to recover the security credential 
based on a response received from the user via the 
controlling means. 
(Emphasis added). 

Applicants respectfully submit that claim 14 is allowable over the cited art for at least the 

reason that Thompson fails to disclose, teach, or suggest a "computer security system, 

comprising... means for accessing verification data disposed on the client to enable the user to 

recover the security credential based on a response received from the user via the 

controlling means" as recited in claim 14. More specifically, the Office Action argues that 

Thompson, with regard to FIG. 4: 

herein disclosed is information disposed on the client 
which implements a recovery mechanism... for the purpose of 
examination, the examiner interprets "to recover the security 
credential from the client" in a manner consistent with the 
applicant's specification. Specifically, the applicant states in 
paragraph 15, "For example, as used herein, "recovering" security 
credential 100 includes enabling the user to independently reset 
security credential 100, and/or automatically having security 
credential 100 reset for the user by security module 70 without 
assistance from support personnel or an external computer 
resource. 
(OA page 3, line 13). 

Applicants commend the Examiner for referring to the specification to determine the 
proper scope of claim elements, but respectfully disagrees with this analysis for at least the 
reason that the Office Action appears to analyze the passage cited from the specification in a 
vacuum. More specifically, beginning on the first line paragraph [0015], the present application 
states "[v]erification data 94 comprises information associated with a querv/response 
mechanism to enable the user of client 12 to independently recover a security credential 10 
independent of a computer resource external to client 12" ( emphasis added ). As illustrated in 
this passage, the term "recover" does not appear to be limited to merely resetting a security 
credential. The term "recover" instead is to be viewed as an action that is utilized when the 
security credential is lost and/or is otherwise unavailable to a user. 
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Conversely, Thompson discloses receiving a password from a user (FIG. 4, block 404), 
determining whether the received password is valid (FIG. 4, block 408), and changing the 
password (FIG. 4, blocks 412, 414, 420). As illustrated in FIG. 4, the password of Thompson is 
known, and the user is merely changing the known password to a new known password. 
Consequently, nothing in Thompson is "recovered" and thus, the Office Action has failed to 
establish a proper 34 U.S.C. §1 02(b) rejection. For at least these reasons. Applicants 
respectfully traverse this rejection, and submits that claim 14 is allowable in view of the cited art. 



C. Claim 19 is Allowable Over Thompson 

The Office Action indicates that claim 19 stands rejected under 35 U.S.C. §1 02(b) as 

allegedly being anticipated by European Patent Number 1,111,495 {"Thompson"). Applicants 

respectfully traverse this rejection on the grounds that Thompson does not disclose, teach, or 

suggest all of the claimed elements. More specifically, claim 1 9 recites: 

A computer security method, comprising: 

receiving a request at a client to access a secure computer 

resource, a security credential required from a user to access the 

secure computer resource; 

presenting verification data disposed on the client to the 

user; and 

enabling the user to recover the security credential 
from the client based on a response received from the user to 
the verification data. 
(Emphasis added). 

Applicants respectfully submit that claim 19 is allowable over the cited art for at least the 
reason that Thompson fails to disclose, teach, or suggest a "computer security method, 
comprising... enabling the user to recover the security credential from the client based on 
a response received from the user to the verification data" as recited in claim 19. More 

specifically, the Office Action argues that Thompson, with regard to FIG. 4: 

herein disclosed is information disposed on the client 
which implements a recovery mechanism... for the purpose of 
examination, the examiner interprets "to recover the security 
credential from the client" in a manner consistent with the 
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applicant's specification. Specifically, the applicant states in 
paragraph 15, "For example, as used herein, "recovering" security 
credential 100 includes enabling the user to independently reset 
security credential 100, and/or automatically having security 
credential 100 reset for the user by security module 70 without 
assistance from support personnel or an external computer 
resource. 
(OA page 3, line 13). 

Applicants commend the Examiner for referring to the specification to determine the 
proper scope of claim elements, but respectfully disagrees with this analysis for at least the 
reason that the Office Action appears to analyze the passage cited from the specification in a 
vacuum. More specifically, beginning on the first line paragraph [0015], the present application 
states "Verification data 94 comprises information associated with a auerv/response 
mechanism to enable the user of client 12 to independently recover a security credential 10 
independent of a computer resource external to client 12" (emphasis added ). As illustrated in 
this passage, the term "recover" does not appear to be limited to merely resetting a security 
credential. The term "recover" instead is to be viewed as an action that is utilized when the 
security credential is lost and/or is otherwise unavailable to a user. 

Conversely, Thompson discloses receiving a password from a user (FIG. 4, block 404), 
determining whether the received password is valid (FIG. 4, block 408), and changing the 
password (FIG. 4, blocks 412, 414, 420). As illustrated in FIG. 4, the password of Thompson is 
known, and the user is merely changing the known password to a new known password. 
Consequently, nothing in Thompson is "recovered" and thus, the Office Action has failed to 
establish a proper 34 U.S.C. §1 02(b) rejection. For at least these reasons. Applicants 
respectfully traverse this rejection, and submits that claim 19 is allowable in view of the cited art. 

D. Claim 31 is Allowable Over Thompson 

The Office Action indicates that claim 31 stands rejected under 35 U.S.C. §1 02(b) as 
allegedly being anticipated by European Patent Number 1,111,495 ('Thompson"). Applicants 
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respectfully traverse this rejection on ttie grounds ttiat Thompson does not disclose, teach, or 
suggest all of the claimed elements. More specifically, claim 31 recites: 



A computer security system, comprising: 
a processor; and 

a memory component that stores: 

a collection module adapted to receive and store 
verification data associated with a user on a client; and 

a recovery module adapted to enable the user to 
recover from the client a security credential associated with 
accessing a secure computer resource via the client by 
verifying the user response to the verification data. 
(Emphasis added). 

Applicants respectfully submit that claim 31 is allowable over the cited art for at least the 
reason that Thompson fails to disclose, teach, or suggest a "computer security system, 
comprising... a memory component that stores... a recovery module adapted to enable the 
user to recover from the client a security credential associated with accessing a secure 
computer resource via the client by verifying the user response to the verification data " 
as recited in claim 31 . More specifically, the Office Action argues that Thompson, with regard to 
FIG. 4: 

herein disclosed is information disposed on the client 
which implements a recovery mechanism... for the purpose of 
examination, the examiner interprets "to recover the security 
credential from the client" in a manner consistent with the 
applicant's specification. Specifically, the applicant states in 
paragraph 15, "For example, as used herein, "recovering" security 
credential 100 includes enabling the user to independently reset 
security credential 100, and/or automatically having security 
credential 100 reset for the user by security module 70 without 
assistance from support personnel or an external computer 
resource. 
(OA page 3, line 13). 

Applicants commend the Examiner for referring to the specification to determine the 
proper scope of claim elements, but respectfully disagrees with this analysis for at least the 
reason that the Office Action appears to analyze the passage cited from the specification in a 
vacuum. More specifically, beginning on the first line paragraph [0015], the present application 
states "[v]erification data 94 comprises information associated with a query/response 
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mechanism to enable the user of client 12 to independently recover a security credential 10 
independent of a computer resource external to client 12" ( emphasis added ). As illustrated in 
this passage, the term "recover" does not appear to be limited to merely resetting a security 
credential. The term "recover" instead is to be viewed as an action that is utilized when the 
security credential is lost and/or is otherwise unavailable to a user. 

Conversely, Thompson discloses receiving a password from a user (FIG. 4, block 404), 
determining whether the received password is valid (FIG. 4, block 408), and changing the 
password (FIG. 4, blocks 412, 414, 420). As illustrated in FIG. 4, the password of Thompson is 
known, and the user is merely changing the known password to a new known password. 
Consequently, nothing in Thompson is "recovered" and thus, the Office Action has failed to 
establish a proper 34 U.S.C. §1 02(b) rejection. For at least these reasons, Applicants 
respectfully traverse this rejection, and submits that claim 31 is allowable in view of the cited art. 



E. Claim 40 is Allowable Over Thompson 

The Office Action indicates that claim 40 stands rejected under 35 U.S.C. §1 02(b) as 

allegedly being anticipated by European Patent Number 1,111,495 {^'Thompson"). Applicants 

respectfully traverse this rejection on the grounds that Thompson does not disclose, teach, or 

suggest all of the claimed elements. More specifically, claim 40 recites: 

A computing device, comprising: 
a processor; and 

a memory component that stores: 

a security module disposed on the computing 
device and configured to control access to a secure computer 
resource associated with the computing device based on 
authentication of a security credential; and 

a recovery module disposed on the computing 
device and configured to enable a user to retrieve the security 
credential from the computing device using verification data 
disposed on the computing device without accessing a 
resource external to the computer device. 
(Emphasis added). 
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Applicants respectfully submit that claim 40 is allowable over the cited art for at least the 

reason that Thompson fails to disclose, teach, or suggest a "computing device, comprising... a 

memory component that stores... a recovery module disposed on the computing device and 

configured to enable a user to retrieve the security credential from the computing device 

using verification data disposed on the computing device without accessing a resource 

external to the computer device" as recited in claim 40. More specifically, the Office Action 

argues that Thompson, with regard to FIG. 4: 

herein disclosed is information disposed on the client 
which implements a recovery mechanism... for the purpose of 
examination, the examiner interprets "to recover the security 
credential from the client" in a manner consistent with the 
applicant's specification. Specifically, the applicant states in 
paragraph 15, "For example, as used herein, "recovering" security 
credential 100 includes enabling the user to independently reset 
security credential 100, and/or automatically having security 
credential 100 reset for the user by security module 70 without 
assistance from support personnel or an external computer 
resource. 
(OA page 3, line 13). 

Applicants commend the Examiner for referring to the specification to determine the 
proper scope of claim elements, but respectfully disagrees with this analysis for at least the 
reason that the Office Action appears to analyze the passage cited from the specification in a 
vacuum. More specifically, beginning on the first line paragraph [0015], the present application 
states "[v]erification data 94 comprises information associated with a auerv/response 
mechanism to enable the user of client 12 to independently recover a security credential 10 
independent of a computer resource external to client 12" ( emphasis added ). As illustrated in 
this passage, the term "recover" does not appear to be limited to merely resetting a security 
credential. The term "recover" instead is to be viewed as an action that is utilized when the 
security credential is lost and/or is otherwise unavailable to a user. 

Conversely, Thompson discloses receiving a password from a user (FIG. 4, block 404), 
determining whether the received password is valid (FIG. 4, block 408), and changing the 
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password (FIG. 4, blocks 412, 414, 420). As illustrated in FIG. 4, the password of Thompson is 
known, and the user is merely changing the known password to a new known password. 
Consequently, nothing in Thompson is "recovered" and thus, the Office Action has failed to 
establish a proper 34 U.S.C. §1 02(b) rejection. For at least these reasons. Applicants 
respectfully traverse this rejection, and submits that claim 40 is allowable in view of the cited art. 

F. Claims 2 - 13. 15 - 18. 20 - 30. 32 - 39. and 41 - 46 are Allowable Over 
Thompson 

The Office Action indicates that claims 2 - 13, 15 - 18, 20 - 30, 32 - 39, and 41 - 46 
stand rejected under 35 U.S.C. §102(b) as allegedly being anticipated by European Patent 
Number 1,1 1 1,495 ('Thompson"). Applicants respectfully traverse this rejection on the grounds 
that Thompson does not disclose, teach, or suggest all of the claimed elements. More 
specifically, dependent claims 2 - 13 are believed to be allowable for at least the reason that 
these claims depend from and include the elements of allowable independent claim 1 . 
Dependent claims 15 - 18 are believed to be allowable for at least the reason that these claims 
depend from and include the elements of allowable independent claim 14. Dependent claims 
20 - 30 are believed to be allowable for at least the reason that these claims depend from and 
include the elements of allowable independent claim 19. Dependent claims 32 - 39 are 
believed to be allowable for at least the reason that these claims depend from and include the 
elements of allowable independent claim 31 . Dependent claims 41-46 are believed to be 
allowable for at least the reason that these claims depend from and include the elements of 
allowable independent claim 40. In re Fine, Minnesota Mining and Mfg.Co. v. Chemque, Inc., 
303 F.3d 1294, 1299 (Fed. Cir. 2002). 
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CONCLUSION 

For at least the reasons set forth above, Applicants respectfully submit that all objections 
and/or rejections have been traversed, rendered moot, and/or accommodated, and that the now 
pending claims are in condition for allowance. Favorable reconsideration and allowance of the 
present application and all pending claims are hereby courteously requested. 

Any other statements In the Office Action that are not explicitly addressed herein are not 
intended to be admitted. In addition, any and all findings of Inherency are traversed as not 
having been shown to be necessarily present. Furthermore, any and all findings of well-known 
art and Official Notice, or statements Interpreted similarly, should not be considered well-known 
for the particular and specific reasons that the claimed combinations are too complex to support 
such conclusions and because the Office Action does not include specific findings predicated on 
sound technical and scientific reasoning to support such conclusions. 

If, In the opinion of the Examiner, a telephonic conference would expedite the examination 
of this matter, the Examiner Is Invited to call the undersigned attorney at (770) 933-9500. 

Respectfully submitted, 

lafbl 

Anthony F. Bonner Jr. Reg. No. 55,012 

THOMAS, KAYDEN, 
HORSTEMEYER & RISLEY, LLP. 

Suite 1500 

600 Galleria Parkway BE 
Atlanta, Georgia 30339 
(770) 933-9500 
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